fix(publish): require submit marker before platform write

server/internal/tenant/app/desktop_task_service.go

@@ -722,8 +722,9 @@ func (s *DesktopTaskService) Extend(ctx context.Context, client *repository.Desk
 // MarkPublishSubmitStarted records a durable intent marker right before the client performs the
 // irreversible platform submit POST. Lease-recovery uses it to avoid silently re-posting a
 // non-idempotent article: once submit may have started, recovery routes the task to 'unknown'
-// (manual reconcile) instead of auto-requeueing it. Best-effort — a stale/lost lease is a no-op
-// and must never block the in-flight publish.
+// (manual reconcile) instead of auto-requeueing it. The client must receive a
+// positive marker write before it performs the platform submit; a stale/lost
+// lease is rejected so the client can stop before the irreversible request.
 func (s *DesktopTaskService) MarkPublishSubmitStarted(ctx context.Context, client *repository.DesktopClient, taskID uuid.UUID, leaseToken string) error {
 	if s == nil || s.pool == nil || client == nil {
 		return nil
@@ -732,7 +733,7 @@ func (s *DesktopTaskService) MarkPublishSubmitStarted(ctx context.Context, clien
 	if leaseToken == "" {
 		return response.ErrBadRequest(40001, "invalid_params", "lease_token is required")
 	}
-	if _, err := s.pool.Exec(ctx, `
+	tag, err := s.pool.Exec(ctx, `
 		UPDATE desktop_tasks
 		SET publish_submit_started_at = COALESCE(publish_submit_started_at, NOW()),
 		    updated_at = NOW()
@@ -741,9 +742,13 @@ func (s *DesktopTaskService) MarkPublishSubmitStarted(ctx context.Context, clien
 		  AND kind = 'publish'
 		  AND status = 'in_progress'
 		  AND lease_token_hash = $3
-	`, taskID, client.ID, HashDesktopClientToken(leaseToken)); err != nil {
+	`, taskID, client.ID, HashDesktopClientToken(leaseToken))
+	if err != nil {
 		return response.ErrInternal(50200, "desktop_task_submit_marker_failed", "failed to mark publish submit started")
 	}
+	if tag.RowsAffected() == 0 {
+		return response.ErrConflict(40983, "desktop_task_lease_invalid", "desktop task lease token is invalid or expired")
+	}
 	return nil
 }